This vulnerability (CVE-2025-40897) in Nozomi Networks Guardian involves incorrect authorization (CWE-863) within the Threat Intelligence feature. Specifically, users granted only view-only privileges can bypass intended access controls to execute administrative actions, including modifying rules configurations and impacting their availability. The issue is due to a failure to properly enforce access restrictions for view-only users. The CVSS 4.0 base score is 7.2, reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability. No patch or official remediation level has been provided by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

An authenticated user with only view-only privileges can escalate their permissions to perform administrative actions on the Threat Intelligence functionality. This could lead to unauthorized modification of rules configurations and disruption of their availability, potentially impacting the security monitoring capabilities of the affected system. The vulnerability affects the integrity and availability of the Threat Intelligence feature but does not indicate impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Nozomi Networks communications for updates. Until a patch is available, restrict access to the Threat Intelligence functionality to trusted users only and review user privilege assignments carefully to minimize risk.